1. Field of the Invention
The present invention is related to the field of data network security and, more particularly, to a system and method for covertly managing passive network devices from a remote location.
2. Description of the Related Art
The emergence of Internet commerce has forced large organizations to connect their internal networks to public networks, with the resulting increase in risk being inevitable. The security industry progressively provides the procedures, tools and countermeasures to respond to this increased risk. Security solutions may be broadly categorized as active or passive.
Network devices are active if they are required to set up a functional infrastructure and may include, among others, access control (firewalls), content filtering (anti-virus), and strong authentication (radius). Conversely, network devices which are not required to set up a functional infrastructure are passive and are typically used to build a second line of defense. Passive devices include, for example, intrusion detection and network scanning.
Two tools commonly used by organizations to obtain network security include the firewall as an active component, and intrusion detection as a passive component.
The firewall is an active component in that it affirmatively decides, for each inbound or outbound packet, whether the packet is to be accepted or dropped. The firewall is located at a key point of the network, meaning a point where all the traffic from/to the public network can be controlled. However, while the firewall is an important piece of network security, it remains vulnerable for at least three reasons. First, firewalls are not immune to network attacks hidden in legitimate packets; half-open connection attack, resulting from a protocol flow, or packet fragmentations are two better known examples. Second, firewalls, like other software implementations, are not immune to software bugs. Third, firewalls are administered by security administrators who can make mistakes or who may be inadequately trained to fulfill their function.
For at least these reasons, the firewall itself needs to be protected. Like any other protection device, a firewall cannot resist assault indefinitely and thus is vulnerable if an alert is not triggered within a defined period of time. Hence, intrusion detection systems are used to provide such alerts.
Intrusion-detection systems may be either host-based or network-based. Host-based intrusion detection systems are installed on servers and monitor important system resources like files, processes and system activity. Network-based intrusion-detection systems are connected to key points of the network and monitor traffic from/to public networks.
To protect themselves against potential intruders, some passive network devices need to remain hidden. This means that while they are physically connected to the network and able to tap any network traffic, they do not answer to any kind of request. Network-based intrusion detection systems are often invisible, meaning that the network interface card (NIC) on which they capture the network traffic has its communication stack disabled. Disabling the communication stack is the absolute protection guarantee against attacks coming from the network and should be a requirement for a passive device that must remain uncompromised.
Problems arise when hidden passive network devices need to be managed from a remote location. Most network-based devices need to be administered from or communicate with a management center. To do so, the device uses either forged packets that are pushed on the local network or an additional NIC connected to the internal network with standard IP-based traffic used to communicate with the management server. Both of these methods annihilate the protection guarantee offered by a passive device; in the first case, the management center could be compromised, in which case resulting effects are unpredictable and, in the second case, the internal network is a perfect backdoor.
Accordingly, a need exists for a method allowing passive network devices to be covertly managed from a remote location.